updated certbot files

roles/nginx-proxy/templates/certbot-entrypoint.sh

@@ -0,0 +1,23 @@
+#!/bin/sh
+set -e
+
+# Generate cert if not exists (first-run)
+if [ ! -d "/etc/letsencrypt/live/{{ matrix_domain }}" ]; then
+  echo "Requesting initial Let's Encrypt certificate..."
+  certbot certonly --standalone \
+    --non-interactive --agree-tos --email admin@{{ matrix_domain }} \
+    -d {{ matrix_domain }} \
+    --domain {{ matrix_domain }} \
+    --preferred-challenges http \
+    --http-01-port 8080 \
+    --server https://acme-v02.api.letsencrypt.org/directory || true
+
+  # For staging (dev): use --server https://acme-staging-v02.api.letsencrypt.org/directory
+fi
+
+# Try to renew (non-blocking)
+echo "Attempting certificate renewal..."
+certbot renew --dry-run --quiet || true
+
+# Start Nginx (certs will be loaded if they exist)
+exec "$@"